CVE-2026-31987
Apache Airflow: JWT token appearing in logs
- State
- Published
- Severity
- 7.5 High
- Published
- Apr 16, 2026
- Updated
- Apr 18, 2026
- Reserved
- Mar 10, 2026
Description
JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix.
Users are recommended to upgrade to version 3.2.0, which fixes this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-532 Insertion of Sensitive Information into Log File
Affected Products
| Product | Versions |
|---|---|
Apache AirflowApache Software Foundation |
|
References
- https://github.com/apache/airflow/pull/62964patch
- https://github.com/apache/airflow/issues/62428issue-tracking
- https://github.com/apache/airflow/issues/62773issue-tracking
- https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6gvendor-advisory
- http://www.openwall.com/lists/oss-security/2026/04/16/7
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.